Commit 18e4808c authored by Marc-André Lureau's avatar Marc-André Lureau Committed by Dave Airlie

renderer: avoid out of bound sampler array access

Fix found thanks to american fuzzy lop.
Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
parent 775f5ed6
......@@ -3412,6 +3412,12 @@ void vrend_bind_sampler_states(struct vrend_context *ctx,
return;
}
if (num_states > PIPE_MAX_SAMPLERS ||
start_slot > (PIPE_MAX_SAMPLERS - num_states)) {
report_context_error(ctx, VIRGL_ERROR_CTX_ILLEGAL_CMD_BUFFER, num_states);
return;
}
ctx->sub->num_sampler_states[shader_type] = num_states;
for (i = 0; i < num_states; i++) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment